Tuesday, July 16, 2024
EHA

Zoom Flaws Can Be Exploited By Hackers by Sending Specially Crafted Messages

Four critical security vulnerabilities have been fixed recently in the popular video conferencing service Zoom. These security flaws could be exploited by the threat actors to send specially crafted XMPP messages to another user and then run malicious code on that server using the compromised user’s computer.

The vulnerabilities that are addressed recently range from 5.9 to 8.1 on the severity scale. All four security flaws were discovered and reported in February 2022 by Ivan Fratric of Google Project Zero.

Bugs Detected & Fixed

It should be noted that the company now addressed the following vulnerabilities:-

  1. CVE ID: CVE-2022-22784
  2. Description: Improper XML Parsing in Zoom Client for Meetings
  3. CVSS score: 8.1
  4. Severity: High
  1. CVE ID: CVE-2022-22785
  2. Description: Improperly constrained session cookies in Zoom Client for Meetings
  3. CVSS score: 5.9
  4. Severity: Medium
  1. CVE ID: CVE-2022-22786
  2. Description: Update package downgrade in Zoom Client for Meetings for Windows
  3. CVSS score: 7.5
  4. Severity: High
  1. CVE ID: CVE-2022-22787
  2. Description: Insufficient hostname validation during server switch in Zoom Client for Meetings
  3. CVSS score: 5.9
  4. Severity: Medium

Exploitation

Among all of them, CVE-2022-22784 with a CVSS score of 8.1 is the most severe flaw fixed by Zoom. This vulnerability is related to improper XML parsing in the Zoom Client for Meetings.

In the exploitation of the vulnerability, the threat actor is able to create a distinct message context and break away from the current XMPP message context. In this way, different actions are performed by the user’s client on the receiving end.

Zoom’s chat feature is built upon the XMPP standard and therefore enables a high level of interaction. As a result of exploiting the aforementioned vulnerabilities, the threat actors can pose as regular users to steal sensitive information. 

This will result in arbitrary code execution due to the downgrade attack caused by a suspicious server. XML parsers in the software’s client and server can be found to have inconsistencies by cyberattackers.

The victim of such an attack will receive XMPP stanzas which can be used to communicate with the attackers.

A Zoom client with a less secure version of the software can be served up via a man-in-the-middle server that hijacks the software update mechanism.

In a nutshell, Zoom is releasing patches to fix two high-severity flaws, CVE-2022-22782 and CVE-2022-22783 which were found approximately one month ago. 

The vulnerabilities could lead to escalation of privileges within the on-premise Meetings service and disclosure of memory contents, both of which could lead to local privilege escalation. 

Zoom’s macOS app was also victimized by a downgrade attack (CVE-2022-22781) which was also fixed. To mitigate any potential threat arising out of active exploitation of the vulnerability, it is recommended that all users of the application update to the latest version (5.10.0) of the app.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

MirrorFace Attacking Organizations Exploiting Vulnerabilities In Internet-Facing Assets

MirrorFace threat actors have been targeting media, political organizations, and academic institutions since 2022,...

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...

Hacktivist Groups Preparing for DDoS Attacks Targeting Paris Olympics

Cyble Research & Intelligence Labs (CRIL) researchers have identified a cyber threat targeting the...

Critical Cellopoint Secure Email Gateway Flaw Let Attackers Execute Arbitrary Code

A critical vulnerability has been discovered in the Cellopoint Secure Email Gateway, identified as...

Singapore Banks to Phase out OTPs for Bank Account Logins Within 3 Months

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS)...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles